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Abstract 

In this expository paper we discuss a relatively new counterfeit coin 
problem with an unusual goal: maintaining the privacy of, rather than 
revealing, counterfeit coins in a set of both fake and real coins. We in¬ 
troduce two classes of solutions to this problem — one that respects the 
privacy of all the coins and one that respects the privacy of only the fake 
coins — and give several results regarding each. We describe and gener¬ 
alize 6 unique strategies that fall into these two categories. Furthermore, 
we explain conditions for the existence of a solution, as well as showing 
proof of a solution’s optimality in select cases. In order to quantify exactly 
how much information is revealed by a given solution, we also define the 
revealing factor and revealing coefficient; these two values additionally act 
as a means of comparing the relative effectiveness of different solutions. 
Most importantly, by introducing an array of new concepts, we lay the 
foundation for future analysis of this very interesting problem, as well as 
many other problems related to privacy and the transfer of information. 


1 Introduction 

In 2007 Alexander Shapovalov suggested an unusual coin weighing problem for 
the sixth international Kolmogorov math tournament [4] . 

A judge is presented with 80 coins that all look the same, knowing 
that there are either two or three fake coins among them. All the 
real coins weigh the same and all the fake coins weigh the same, but 
the fake coins are lighter than the real ones. 

A lawyer knows that there are exactly three fake coins and which 
ones they are. The lawyer must use a balance scale to convince the 
judge that there are exactly three fake coins. She is bound by her 
contract to not reveal any information about any particular coin. 

How should she proceed? 

Why is this problem so unusual? Let’s take a look back at history. The 
first coin weighing problems appeared around 1945 [5JIS]. In all of them, the 
goal was simply to find a single fake coin amongst many real coins. After that, 
many generalizations followed: newer versions of the counterfeit coin problem 
included finding multiple fake coins, differentiating between coins of arbitrary 
weights, and so on. All of them, however, had the additional goal of minimizing 
the number of weighings necessary to locate the fake coin(s); see [T] and its 
many references. 
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Shapovalov’s puzzle is the first problem to switch the attention to maintain¬ 
ing the privacy of coins rather than eliminating it. This puzzle is very important 
and modern; like many other “coin weighing” problems, it is not about coins— 
rather, it uses coins to model ideas and create a simplified version of real life 
privacy problems and their potential solutions. 


2 A Simplified Version 

Let us consider a simpler version of Shapovalov’s puzzle to get our feet wet: 

Example 1. A lawyer presents 80 identical coins to a judge, who knows that 
among them there are either one or two fake coins. All the real coins weigh the 
same and all the fake coins weigh the same, but the fake coins are lighter than 
the real ones. 

The lawyer knows that there are exactly two fake coins and which ones they 
are. Can the lawyer use a balance scale to convince the judge that there are 
exactly two fake coins without revealing any information about any particular 
coin? 

We will offer several strategies for different versions of this puzzle, so we 
would like to number them. Here is the first strategy to solve Example [T] 

Strategy 1. The lawyer divides the coins into two piles of 40 so that each pile 
contains exactly one fake coin. She then puts the piles in the different pans of 
the scale. 

The scale will balance, which means that the number of fake coins is the 
same in both of the pans. Therefore, the total number of fake coins is even, and 
in this case is exactly 2. For any particular coin, the judge can’t definitively say 
whether it is real or fake; we have thus succeeded in our task. 

Let us introduce some notation before we move forward. We will denote 
the total number of coins by t, the actual number of fake coins by /, and the 
number of fake coins that we are trying to disprove by d. 

We would also like to give a name to a strategy or a series of weighings 
after which the judge knows nothing about the authenticity of any specific coin. 
Knop [3] suggests that such strategies be called shapovalov in honor of the 
puzzle’s designer. One of the authors [3] uses the name unrevealing. We do 
not like the name “unrevealing” as we plan to show that all strategies do reveal 
some information. We like the name “shapovalov,” but we also want to have a 
descriptive name. 

Definition 1. We will call a set of weighings or a strategy where no information 
about any particular coin is revealed discreet. Otherwise, we call the set of 
weighings indiscreet. 

For the time being, we are only concerned with discreet (shapovalov) strate¬ 
gies. We will refer to a given example with the set of three numbers t-f-d. For 
example, we will refer to Example[l]as Example[T] (80-2-1). 

Strategy 1*. The lawyer divides the coins into / equal groups with one fake 
coin in each and shows that all of them are equal in weight. 
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Later, we will see that this strategy can be adjusted to a more general case 
when / and t have a common divisor that doesn’t divide d. 

Now we can come back to the original puzzle (80-3-2) and discuss its solution. 


3 Solutions to the Original Problem 

Motivated by the strategy used in the previous example, the lawyer can try to 
divide 80 coins into three groups, each containing one fake coin. Clearly, 80 is 
not divisible by 3, so she makes the three largest possible groups of the same 
size: each of 26 elements with one fake coin. The lawyer uses two weighings 
on the scale to demonstrate to the judge that all three groups have the same 
weight. What can the judge conclude? He can conclude that either there are 
3 fake coins—one in each group, or there are 2 fake coins and they are in the 
leftover group of 2 coins. Unfortunately, this strategy is not good enough to 
prove to the judge that there are exactly 3 fake coins. The lawyer decides not 
to give up and adjusts the strategy in the following manner: 

Strategy 2. (80-3-2) 

The lawyer starts by showing that the three groups of 26 coins, containing 
one fake coin each, have the same weight. She continues by comparing one of 
the coins in the leftover group to a real coin not in the leftover group. 

In this case, the judge can deduce that one of the leftover coins can balance 
against a coin from one of the larger groups only when the leftover group does 
not contain fake coins. Therefore, there must be 3 fake coins. The lawyer 
proved just what she wanted, and we should be done—but wait, the strategy 
is indiscreet! After our set of weighings, the judge will know that both the 
two leftover coins and one of the coins we used in the last weighing are real. 
Although the lawyer proved that there must be three fake coins, in the process 
she violated the privacy of three real coins. 

The strategies in this section are adapted from Knop’s paper [3] (in Russian), 
where he provides different solutions for (100-3-2) problem. Let us suggest 
another solution. 

Strategy 3. (80-3-2) 

The lawyer divides all coins into four piles: A, B, C, and D with 20 coins 
each, making sure that piles A, H, and C all contain one fake coin. She then 
conducts three weighings comparing each of A, B, and C to H, in the process 
showing that each of A, B, and C is lighter than D. 

Therefore, each of A, B, and C has to contain a fake coin. Once again, the 
lawyer successfully proves to the judge that there are 3 fake coins. Unfortu¬ 
nately, the strategy is still indiscreet because the lawyer violates the privacy of 
all 20 coins in the D pile. 

Now we will present the official solution from the competition. 

Strategy 4. (80-3-2) 

The lawyer divides all coins into 5 piles: A and B with 10 coins each, and C, 

D, and E with 20 coins each, so that the three fake coins are in piles A, D, and 

E. The lawyer then conducts three weighings. In the first, she compares A -|- C 
against B + D, and the scale balances. In the second weighing she compares 
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A+B against E, and the scale balances again. In the last weighing she compares 
C + D against A + B + E, and shows that the second pan is lighter. 

Let us analyze this strategy. The third weighing demonstrates that A+B+E 
must contain some fake coins. The second weighing shows the judge that the 
number of fake coins in A + B + i? is even; this means that the pile A + B + E has 
exactly 2 fake coins, one in E and the other in A + B. In this case A + B + C + D 
clearly has fake coins, and because of the first weighing the number of them is 
even. Therefore, C + D has a fake coin. We can then conclude that the total 
number of fake coins is 3. What does the judge know about the individual 
coins? One coin is in E, one in A + B and one in C + D. In addition, if A 
contains a fake coin, then D contains the other one. If B contains a fake coin, 
then C has the other one. The privacy of every individual coin is preserved and 
the strategy is discreet. 

We now offer one more discreet (shapovalov) strategy for this problem. 
Strategy 5. (80-3-2) 

The lawyer divides all the coins into nine piles: Ai, Bi, Ci, A 2 , B 2 , C 2 , 
A3, B3 and C3 of sizes 24, 1, 2, 24, 1, 2, 23, 2, and 1 respectively. The lawyer 
demonstrates that Ai+ Bi = A2 + B2 = A3 + B3. Additionally, she shows that 
Bi -|- Cl = B2 + C2 = B3 + C3. 

The judge can easily see that if Ai + Bi contains a fake coin, then this 
pile contains exactly one fake coin and the total number of fake coins is 3. If 
Ai + Bi doesn’t contain a fake coin, then all fake coins must be concentrated in 
Cl -I- C 2 -f C 3 . Similarly, if Bi + Ci contains a fake coin, then this pile contains 
exactly one fake coin and the total number of fake coins is 3. If i?i -I- Ci doesn’t 
contain a fake coin, then all fake coins must be concentrated in Ai +A2 + A3. If 
both Ai -I- Bi and Bi + Ci contain a fake coin, then there must be 3 fake coins 
in the triplet Bi + B2 + B3. Summarizing gives us three different ways for the 
fake coins to be distributed: 

1. one fake coin in one of each: Ai, A 2 , A 3 (sizes 24, 24, 23) 

2 . one fake coin in one of each: Bi, B 2 , B 3 (sizes 1 , 1 , 2 ) 

3. one fake coin in one of each: Ci, C 2 , C 3 (sizes 2 , 2 , 1 ) 

In all cases, we have ruled out the possibility of there being two fake coins, 

and no coin in particular has its identity revealed. 

See more examples of both insufficient and correct solutions in Knop’s article 
[3] (in Russian). 

4 Discreet Coin Weighings 

The original puzzle is tricky, but we’ve already managed to demonstrate two 
solutions. Is it always possible to find a solution that respects the privacy of 
each individual coin? Or, in our new definition, is it always possible to find a 
discreet set of weighings? 

Let us point out the trivial fact that if / = 0 or / = t (and thus the lawyer 
has to prove to the judge that all coins are real/fake) the privacy of every coin 
is guaranteed to be violated as a result of the statement being proven. 
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In order to prevent the identity of any given coin from being revealed, we 
will only consider the cases for which 0 < f < t, and thus the statement that we 
are trying to prove is itself discreet. However, as the following lemmas prove, it 
is not always possible to have a discreet set of weighings in this case. 

Lemma 1. For t > 1 and f = I it is impossible to have a discreet strategy. 

Proof. Suppose such a strategy exists and the lawyer convinces the judge that 
the total number of fake coins is 1. Now consider any weighing that is carried 
out. If it is balanced, then the coins on both pans are all necessarily real. If 
it is not balanced, then we know that the heavier pan has only real coins. In 
either case some of the coins are revealed to be genuine, and thus the strategy 
is indiscreet. □ 

We use symmetry to prove the following lemma. 

Lemma 2. For t > 1 and f = t — 1 it is impossible to have a discreet strategy. 

Proof. Suppose such a strategy exists. By the same logic shown in Lemma [TJ 
any such strategy will necessarily reveal 1 fake coin. Thus, the strategy is 
indiscreet. □ 

Lemma 3. For f = 2 and d = 0 it is impossible to have a discreet strategy. 

Proof. If a weighing is not balanced, then the heavier pan must have only real 
coins. If all the weighings are balanced, the judge can’t differentiate between 2 
fake coins and 0 fake coins—we end up proving nothing. □ 

We will later show that the above examples are not the only exceptions to 
the existence of a discreet strategy, but these next examples are more involved; 
they are thus produced in Section 15.41 


5 The Revealing Factor and Coefficient 

Let’s go all the way back to Strategy [T] (80-2-1), in which the lawyer splits the 
coins into two groups of 40. Suppose the judge just knows that there are 2 fake 
coins. What are his chances of finding a single fake coin before the weighing? 
They are simply 2 in 80. After the weighing the judge knows that there is a 
fake coin in each group of 40, so his chance of finding one coin is 1 in 40—the 
same as before. It seems as though no information is revealed, but this is not 
the case. 

It turns out that some information is revealed in the process of weighing the 
coins. Before the weighings, the two counterfeits can be any of the 80 coins, 
and the number of equally likely distributions of these fake coins is (® 2 °) = 3160. 
After the weighings, there is one fake in each pile of 40, and the number of 
possibilities is reduced to (^°) = 1600. 

We would like to introduce the notions of a revealing factor and a revealing 
coefficient to quantify this observation. Before the weighings, if the judge knows 
that the number of fake coins is exactly /, then any set of / coins might be the 
set of fake coins. The number of equally likely possibilities is (j.), and we will call 
this value old possibilities. After the weighings, the set of possibilities decreases 
so that not any arbitrary group of / coins could be the set of fake coins. We call 
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the number of sets of / coins that could be fake after the weighings are done 
the new possibilities. 

Definition 2. We call the ratio of the number of old possibilities to the new 
possibilities after a successful strategy the revealing factor. We denote it by X: 

^ # old possibilities 

# new possibilities ’ 

We would also like to introduce the notion of a revealing coefficient as used 
in [2]. The revealing coefficient is the portion of information that is revealed 
in the process of proving that there are exactly / fake coins. The revealing 
coefficient is close to 1 if the judge knows the exact location of each fake coin 
and 0 if he receives no extra information other than that which was intended: 
the number of fake coins. 

Definition 3. The revealing coefficient is defined as 1 — IjX. We denote it by 
R: 

^ ^ # new possibilities 

# old possibilities ’ 

We would like both the revealing coefficient and the revealing factor to be 
as small as possible in order to minimize the transfer of information. 

In Strategylll the revealing factor is X = 3160/1600 = 1.98. The revealing 
coefficient is i? = (3160 — 1600)/3160 Ri 0.494, slightly less than one half. 

Let’s calculate the revealing factor and coefficient for our first discreet solu¬ 
tion (StrategylH) to the original problem to help solidify these two new concepts. 
We have five piles A, B, C, D, and E of 10, 10, 20, 20 and 20 coins correspond¬ 
ingly. We showed that there are two possibilities: either piles A, D and E 
contain one fake coin each, or piles B, C, and E contain one fake coin each. Af¬ 
ter the weighings the number of new possibilities is 10-20-20-I-10-20-20 = 8,000. 
The number of old possibilities is (* 3 °) = 82,160. The revealing factor is 
X = = 10.27 and the revealing coefficient is i? = 1 — ~ 0.903. 

We will give one lemma regarding the revealing coefficient: 

Lemma 4. After the first weighing with an equal number of coins in both pans, 
0 < R < 1. 

Proof. The right side of this inequality is trivial as it is always true that the 
number of new possibilities is greater than 0. The left side of this inequality 
is equivalent to saying that the first weighing necessarily reveals information. 
Consider any weighing using 2n coins from the original pile of t, where we have 
n coins in each pan. If the pans are balanced, we know that both groups of 
n coins have the same number of fake coins. If one of the pans is lighter than 
the other, then we know that there are more fake coins in that pan than there 
are in the other. In either case, it is no longer possible for the / fake coins 
to be distributed any way we like; they must be distributed in a way that is 
consistent with the weighing. As a result, it is always true that the number of 
new possibilities is less than (j.), or the number of old possibilities. □ 
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5.1 Different Strategies for Given Parameters Reveal Dif¬ 
ferent Amounts of Information 

Suppose we have 80 coins and we want to prove that 4 are fake as opposed 
to 3. We can use Strategy El to do that: Divide all coins into four piles of 
20 with each pile containing one fake coin. Showing that all piles weigh the 
same tells the judge the number of fake coins must be a multiple of 4, and 
we are done. We can, however, produce another discreet strategy (as hinted 
at briefly in Section [2D: Simply divide the coins into two piles of 40 and put 
two fake coins in each pile. After comparing the two piles the judge knows 
that the number of fake coins is even. Both strategies are discreet, but the 
revealing factor and coefficient are different. The total number of possibilities 
before weighings is = 1, 581, 580. After the first strategy the number of new 
possibilities is 20^ = 160,000. The revealing factor is A Ri 9.9 and the revealing 
coefficient R 0.899. After the second strategy the number of new possibilities 
is {^ 2 )^ = 608,400. The revealing factor is A 2.60 and the coefficient is 
i?« 0.615. 

The second strategy is significantly less revealing; dividing all the coins into 
fewer equivalent piles is clearly preferable in this case. 

We can generalize these two strategies for the case when / and t have a 
common divisor greater than 1. If a > 1 divides both / and t but not d, then 
the following strategy is discreet: 

Strategy 6. The lawyer divides all the coins into a piles, each having the same 
number of fake coins. She then demonstrates to the judge that the piles all have 
the same weight, thus proving that the number of fake coins is divisible by a. 

The revealing factor for this strategy is 

(1) E(JS}LY 

where the right hand side is the value that A approaches as t tends to infinity. 

There are often many values of a that satisfy the above conditions, but the 
smallest possible such value will reveal the least amount of information for this 
strategy. Notice that, when / divides t and we choose a = f, the weighing 
scheme is identical to that of Strategy E 

5.2 The Revealing Factor/Coefficient for Indiscreet Weigh¬ 
ings 

The revealing factor/coefficient can be defined for both discreet and indiscreet 
strategies. Surprisingly, we often see that indiscreet strategies reveal less infor¬ 
mation than discreet strategies do. Let’s go back to the original problem and 
its “wrong,” or rather indiscreet, solutions. In the first solution, described in 
Strategy 121 after the weighings the judge knows the locations of 3 real coins. 
The other coins are divided into 3 groups of 26, 26 and 25 coins, contain¬ 
ing one fake coin each. Thus the number of possibilities after the weighings 
is 26 • 26 • 25 = 16,900. The number of possibilities before the weighings is 
(T) “ revealing factor is A 4.86, and the revealing coefficient 
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is R « 0.794. We see that although this strategy is indiscreet and the privacy 
of 3 real coins is violated, it is less revealing than the discreet Strategy H] with a 
revealing factor of 10.27. We can see that the three coins that were exposed as 
real effectively “sacrificed” their privacy in order to make the other coins more 
secure in their wish to remain hidden. 

The next indiscreet example, Strategy [31 is more revealing than Strategy [3] 
as the groups containing the fake coins are smaller in comparison. The number 
of new possibilities is 20^ = 8000, so the revealing factor is X ss 10.27 and 
the revealing coefficient is i? w 0.903; interestingly, these values are exactly the 
same as those given by discreet Strategy [4] even though one fourth of the entire 
set of coins has its authenticity revealed. 

5.3 An Optimality Proof 

Here we would like to show a proof of optimality for a given discreet strategy. 
Namely, we will consider the case when t = 2k, / = 2 and d = 1, for some 
positive integer A: > 1. We’ve already discussed the strategy (see Strategy O 
using one weighing: divide all the coins into two piles of size k, put fake coins 
into the separate piles, and compare the piles. 

It might seem obvious that this is a “least revealing,” or optimal, strategy, 
but still we need a proof. First, we will introduce more definitions and notation. 
During any weighing, a coin’s presence on the left pan is denoted by L, a coin’s 
presence on the right pan is denoted by R, and a coin not participating (one 
that is left outside of the weighing) is denoted by O. 

After all the weighings, every coin’s path can be described as a string of L’s, 
R’s, and O’s. 

Definition 4. The string of L’s, R’s, and O’s corresponding to the location of 
a given coin in every weighing is called the coin’s itinerary. 

Given an itinerary 5, we denote the set of all coins with this itinerary as 
5, and the size of this set as |5|. We will introduce an involutive operation on 
itineraries called conjugation: 

Definition 5. Given an itinerary 5, the conjugate itinerary, denoted by 5, is the 
unique itinerary in which all R’s are replaced by L’s, and all L’s are replaced 
by R’s. 

Notice that this is an involution as 5 = <5. In addition, the only self-conjugate 
itinerary is a string of Os. After the weighings we can partition all the coins 
into groups by their itineraries. 

In the following preliminary lemma it is not necessary that t be even. 

Lemma 5. If f = 2 and d = 1, then the set of itineraries of a discreet strategy 
satisfies the following properties: If there are coins with itinerary 5, then there 
are coins with itinerary S. In addition, there are no coins with a self-conjugate 
itinerary. Also, all weighings must balance. 

Proof. All weighings must be balanced, otherwise the heavier pan must contain 
only real coins and the strategy is indiscreet. 

It follows that the two fake coins can’t be in the same pan at any point. 
Moreover, if a fake coin is in one of the pans during a weighing, the other fake 


coin must be in the other pan in order to balance it. This means that the fake 
coins have conjugate itineraries. 

Because of the above condition, if there exists a coin with an itinerary S and 
there are no coins with itinerary S, then all the coins in 6 are necessarily real. 

If one coin did not partake in any of the measurements and all the weighings 
were balanced, then we have not disproven the possibility of only one fake coin. 
Thus, there may not be any coins with a self-conjugate itinerary. □ 

Now we are ready to prove the optimality theorem for an even number of 
coins. 

Theorem 6. Ift is even, / = 2 and d = 1, then Strategy{liis the least revealing 
out of any possible strategy. 

Proof. All the coins are partitioned into groups with the same itineraries and 
all the itineraries are paired up by conjugation. The set of itineraries is {Sj, Sj) 
for j = 1, 2, 3,.... If one fake coin belongs to 6j, then the other fake coin must 
belong to 6j. This means the total number of new possibilities is 
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where Sj(|(5jj -I- |(5jD = t is a fixed number. 

Standard algebra arguments show that the number of new possibilities is 
maximized when there is exactly one itinerary pair with two itineraries of equal 
size. □ 

5.4 An Oddity: The Case of Odd t 

We would like to discuss optimality in a more complicated case: when the total 
number of coins is odd, / = 2, and d = 1. 

Lemma 7. A discreet strategy for the given parameters must generate at least 
6 different itineraries. Among the itineraries there will be at least 3 conjugate 
pairs; additionally, the number of coins in the two groups in each pair must be 
of different parity. 

Proof. Since the number of coins is odd, every weighing has some coins that 
aren’t on the scale. This means that one weighing is not enough and we need 
at least one more weighing to account for the coins that are left out. Let us 
restrict the itinerary to these two weighings. We have coins with itineraries LO, 
RO, OL, and OR. Since the number of coins not counted by these itineraries 
is odd, there exist coins with yet another itinerary. Furthermore, as the total 
number of itineraries is even, we can conclude there are at least 6 of them. 

Since the total number of coins is odd, all pairs of itineraries can’t have 
numbers of coins with the same parity; at least one pair must have different 
parity. This pair is on the scale at some point with the same number of coins 
on both pans, implying that at least one other pair of itineraries has different 
parities. The total number of pairs of itineraries with different parities must be 
odd, hence there are at least 3 of them. □ 

Now we will provide some more promised examples for which a discreet 
strategy does not exist. 
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Corollary 8. For / = 2 and d = 1, it is impossible to have a discreet strategy 
when t = t = 5, or t = 7. 

Proof. We already know that the discreet strategy is impossible for t = 3 be¬ 
cause / = t — 1; see Lemma [2J 

Both three and five coins clearly can’t have 6 different itineraries. In addi¬ 
tion, three of the pairs of itineraries have different parity, which means there 
must be at least 3 coins in each pair. The total number of coins is at least 9. □ 


What happens when t > 71 Does the proof for the nonexistence of a discreet 
strategy become increasingly difficult as t increases? No—it turns out that this 
pattern does not continue. Here is a discreet strategy that works for t > 7; this 
strategy is a modification of Strategy [S] 


Strategy 5*. ((2A:-|-l)-2-l) Consider piles A and A of sizes 



— 2 and 



-3 


respectively. Piles B and B have sizes 1 and 2 respectively. Piles C and C have 
sizes 2 and 1. The lawyer distributes the two fake coins into piles A and H, B 
and B, or C and C. 


This strategy has two weighings. In the first the lawyer compares 



- 1 


coins belonging to A and B 


against 


IJ 


1 coins belonging to A and B. In 


the second weighing she compares three coins belonging to B and C against the 
same number of coins in B and C. 


Lemma 9. For / = 2 and d = 1, Strategy 1 .5 ’I is discreet when t is odd and 
t > 7. 


Proof. All coins were on the scale and all the weighings were balanced. This 
means that there are two fake coins. 

No information about any particular coin is revealed as the fake coins can 
belong to any pair of groups with conjugate itineraries. □ 

Lemma 10. Ift is odd, / = 2 and d= 1, then Strategy 1 5 *1 is least revealing. 


Proof. Similar to the proof of Lemma [51 to increase the number of new possibili¬ 
ties we would like to move as many coins as possible to one of the conjugate pairs. 
Given that we have to keep at least 3 pairs of itineraries of different parity, the 


distribution for (|A|, |A|), {\B\, |i3|), and (jCI, IC'D must be 




(1, 2), and (2,1), respectively. The number of new possibilities is 


|A| . |A| + \B\ ■ \B\ + |C| . |C| = - 2 ) - 3 ) + 


1 ■2 + 2 - 1 . 


□ 


As the Theorem m shows, for large enough t we can often find a discreet 


strategy. Let us first introduce such a strategy that is defined for 
f \ d. The strategy is a generalization of Strategy [53 



> 4 and 
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Strategy 5**. Let’s say that we have t = fk + r, where k and r are positive 
integers, 0 < r < /, and fc > 4. We will begin by splitting the coins into 3/ 
total groups: Ai,A 2 ,... ,Af, , B/, and Ci, (72, ■ ■ ■ ,Cf with the same 

itineraries. The lawyer will put one fake coin in each of either Ai, Bi, or Ct, for 
* = 1,2 ,...,/. 

In groups kli for 1 < i < r, we will have \Ai\ = k — 2, and for r + 1 < i < / 
we will have \Ai\ = fc — 3. Similarly, we will have \Bi\ = 1 for 1 < i < r and 
\Bi\ = 2 otherwise, and in groups Ci for 1 < i < r we will have \Ci\ = 2 and 
|(7i| = 1 for all other values of i. 

Now we carry out the weighings as follows. In / — 1 weighings, we show 
that the fc — I coins from each Ai + Bi for 1 < i < f balance one another on 
the scale. In / — 1 more weighings, we demonstrate that the 3 coins from each 
Bi + Ci ior 1 < i < f are equal in weight. 


Theorem 11. 



> 4 and 0 < d < f, Strateav \5**\ is discreet. 


Proof. What can the judge conclude? Every coin was on the scale at some 
point. Suppose that a fake coin is in one of the groups. There are / — 1 other 
groups of the same weight, so there must be at least / fake coins. As d < f, 
there are exactly / fake coins. 

Using similar arguments as in the analysis of Strategy [S] the judge can con¬ 
clude that there are three mutually-exclusive possibilities: 


• each A group contains one fake coin. 


• each B group contains one fake coin. 


• each C group contains one fake coin. 


The privacy of every coin is respected. 


□ 


6 One Shot: Guessing a Single Fake Coin 

So far we have only looked at how much information is revealed about the group 
of fake coins as a whole. We might consider another goal of the judge: trying 
to guess the location of only one fake coin [7]. We already mentioned that 
Strategy [T] (80-2-1) keeps the judge’s ability to guess the fake coin at 1/40, the 
same as before the weighings. 

Strategy [5] (80-3-2) reveals that each of three piles of sizes 26, 26, and 25 
contains a fake coin. The best way for the judge to guess is to choose one coin 
out of the pile with 25 coins. The probability of success is 1/25, which is slightly 
higher than before the weighings: 3/80. 

Strategy [3] (80-3-2) reveals that each of three piles of size 20 contains a fake 
coin. The probability of guessing one fake coin is 1/20. This is worse than 
Strategy m as the judge is more likely to find a fake coin. 

Let us consider the official solution (Strategy H]) for the original problem. 
At the end the judge knows that there are three coins that are distributed as 
follows: 

1. one fake coin in E of size 20, 
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2. one fake coin in A + B oi size 20, 

3. one fake coin in C + D of size 40. 

We see that if the judge wants to guess one fake coin, he can do so with 
probability 1/20. This strategy also improved the judge’s chances of guessing a 
fake coin. 

Strategy [S] (80-3-2) can be analyzed in a manner similar to the previous 
strategies. Recall that this strategy leaves us with three distinct cases for the 
distribution of the three coins: 

1. one fake coin in one of each: Ai, A 2 , A 3 (sizes 24, 24, 23) 

2 . one fake coin in one of each: Bi, B 2 , B 3 (sizes 1 , 1 , 2 ) 

3. one fake coin in one of each: Ci, C 2 , C 3 (sizes 2, 2, 1 ) 

If the judge wants to guess one fake coin, he can pick randomly from A 3 -|- 

Bi + C 3 , a pile of size 25. Thus, his chances of guessing one fake coin are 
1/25: better than before the weighings. However, the judge’s chances might 
signihcantly increase depending on how the lawyer distributes the fake coins. 
This is discussed further in the next section. 

6.1 Minimizing the Chance of Guessing One Fake Coin 

Let us for the duration of this subsection slightly alter the lawyer’s goal. Given 
t, f, and d we want the lawyer to create a strategy that proves to the judge that 
the number of fake coins is / as supposed to d. Just as before, the weighings are 
allowed to be indiscreet, but with the additional goal of minimizing the judge’s 
probability of guessing a single fake coin. 

Consider the lawyer’s options when it comes to hiding the fake coins in 
Strategy 5. A huge problem arises if she chooses each one of the three cases (A, 
B, or C) with probability 1/3. If the judge knows that, then he can pick either 
Bi, JI 2 , or C 3 , and find a fake coin with probability 1/3. To make matters 
worse, if the judge picks a coin from each of i?i, B 2 , and Hs, then he can find 
all of the fake coins with probability 1 / 6 . 

This strategy was clearly too unbalanced. Suppose the lawyer decides to 
place the fake coins in groups Ai, A 2 , A 3 with probability pA, in groups Bi, 
B 2 , B 3 with probability pb, and in groups Ci, C 2 , C 3 with probability pc = 
I-PA -PB- 

Now suppose the judge is trying to randomly guess one counterfeit coin. If 
the judge guesses from the group Ai -|- A 2 -I- A 3 he is successful with probability 
p. 4 / 23 . This is because the smallest such \Ai\ that he can guess from is 23. If 
he guesses from the group Bx + B 2 + B 3 , he is successful with probability pbI^^ 
and if he guesses from the group C 1 +C 2 + C 3 he is successful with probability 
pc!^] this is again because the smallest such \Bi\ and \Ci\ that the judge can 
pick from are both 1. If the lawyer wants to decreases the chances of the judge 
finding one fake coin, she needs to pick probabilities proportional to the sizes 
of the piles. Namely: pA = 23/25 and pb = Pc = 1/25. With this strategy, 
the judge will be able to guess one coin with almost the same probability after 
the weighings as before the weighings: 1/25, which is only slightly larger than 
f/t = 3/80. 
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The initial probability of guessing a fake coin is f /t if the judge knows that 
there are exactly / fake coins. After the weighings, this probability can only 
stay the same or increase. This minimum can be achieved if t and / have a 
common divisor a that doesn’t divide d, utilizing Strategy El 

We proved in Lemma 0] that any set of weighings will increases the judge’s 
chances of finding all the fake coins. On the other hand, if the judge only 
wishes to find one fake coin, the lawyer can sometimes use a strategy that 
doesn’t improve the judge’s chances. However, whether the lawyer’s goal is to 
hide just one fake coin or the entire set of fake coins, indiscreet strategies always 
help the judge: 

Lemma 12. Any indiscreet strategy increases the judge’s ability to guess a 
single fake coin. 

Proof. At least one of the coins will be revealed to be genuine or fake. This 
increases the judge’s ability to guess a fake coin. □ 

On the other hand, if t is large, / and d are small, and / doesn’t divide d, 
there exists an indiscreet strategy that proves that there must be / fake coins, 
and the judge’s ability to guess one fake coin is very close to f /t. This strategy 
is a generalization of Strategy 0] (80-3-2): 

Strategy 2*. The lawyer divides all coins into / piles containing one fake coin 
each, along with some leftover coins so that the number of leftover coins is less 
than /. The lawyer shows that each large pile weighs the same. After that she 
compares the leftover coins to each other and to some other coins if necessary 
to demonstrate that there are at least d -I-1 coins that weigh the same and this 
set of coins contains the leftover coins. 

This shows that the leftover coins have to be real. This also proves that all 
the fake coins are in the / large piles, with each pile containing exactly one fake 
coin. 

For this procedure, the judge borrows at most d-|- 1 — / coins from all of the 
larger piles and shows that they are genuine. This leaves piles of size at least 
[jJ ~ rfl that contain at least one fake coin. This means that for / not dividing 

d, we can create a strategy that gives the judge a probability of -- -j- of 

L/J 

guessing a single fake coin. The probability of guessing one fake coin with this 
strategy clearly approaches f /t as t grows larger. 

Note that in this strategy the lawyer reveals d-l-1 coins to be real. Depending 
on the values of t, /, and d, the lawyer can sometimes tweak the strategy to 
reveal the privacy of fewer coins. 


7 Conclusion 

Do fake coins really need a lawyer’s protection in the courtroom? Most likely 
not. But mathematicians make a living by reducing difficult problems to easier, 
more manageable ones. In short, our discussion demonstrates that collecting 
aggregated information from databases reveals some additional information in 
the process. 
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As an illuminating example, let’s say you filled in an anonymous survey 
about your taste in movies. Although your opinions are very unpopular, you 
feel safe because you never once mentioned your name. The surveyors publish 
the results and mention the curious fact that people who live in towns starting 
with W all hate Star Trek', now you’re in real trouble. Your friends, your spouse, 
and even your dog know that you filled in the survey and now realize that you 
have been lying to them for all these years. 

Although the above example doesn’t use coins, we have conclusively shown 
that aggregated data collection decreases your privacy; this paper is our attempt 
to quantify by how much. 
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